Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

CSX.COM

csx.com

Group Clop
Discovered 2022-12-22 20:02 UTC
Est. attack date 2022-12-22

Description:

CSX rail, intermodal and rail-to-truck transload services - CSX.com

Infostealer activity detected by HudsonRock

Compromised Employees: 49

Compromised Users: 126

Third Party Employee Credentials: 13


External Attack Surface: 109


Infostealer Distribution

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • No emails found.
MX Records
  • csx-com.mail.protection.outlook.com. Microsoft 365
TXT Records
  • perplexity-ai-domain-verification-jf0d99=QUn00uDdoiYIVPTv41AowIi3m
  • mongodb-site-verification=6DiTOcsoODPmHcQaYDxO5oxzl245fMy2
  • v=zoomadn us.zoom.idp.commercial=csx.okta.com
  • hcp-domain-verification=f052fe1a7cf21336b59247e074679402089b599e9568bf39806012268f181095
  • NimbusDDoS-domain-verification=TRB795GPXUNS59AKZCWGTCNWA10GAGSU
  • mongodb-site-verification=Tktyy5E8zbJrW55d3bdlhLVIRho4kCZx
  • mongodb-site-verification=zBNtmC2KRBMk26AogMzIVSIw023ePXGv
  • v2zgC-oyoeJleUGmhDrvKg
  • mongodb-site-verification=ADOlllotrTCZoeUx3MOPFBVsLIjS5v4V
  • mongodb-site-verification=xjJCJ2D0pYdzutQvDNcC5CJPSbjPyBcT
  • mongodb-site-verification=a8SZmBhfhz2iRBySstZHOXm6op2uMCBB
  • facebook-domain-verification=apqn9j66xuj15divnt2k1ys6nmg79n
  • mongodb-site-verification=JSR2ITF5yfTslWiscvorR2wr3LSTfdkO
  • DPXztV+Yk1cj1tnIF6OWSSzXCaGY0euowfOqJqtACiQYrbAv9q9jba5Yq9t3tKAeKzK+y0o0z6qY55YPgjxb7A==
  • v=spf1 mx include:spf.protection.outlook.com include:spf-include.csx.com ip4:216.231.210.162 ip4:216.231.210.163 ip4:216.231.208.128 ip4:216.231.208.151 include:spf-include2.csx.com -all
  • smartsheet-site-validation=qMmXWfPTu-U494_dyxLzSGEt5R_3w5XV
  • mongodb-site-verification=8MqjUMRZt88HT95aqYXpl9iUunVnNzey
  • _x5hdnqakr5n0ishml5n0mw0difonj6m
  • anthropic-domain-verification-t8twbh=iMoB6BGmSWekSYY97UdorTZvw
  • apple-domain-verification=BGap7N1nodGBEiWP
  • cloudhealth=8339515b-76e1-4d8e-b122-4a7f33bdaa65
  • mongodb-site-verification=WI6bwIukLQYzvgZALfSWo1UbMFDmheh8
  • atlassian-domain-verification=akyOxoW5XdYa74qlZJMyFf4szx7RrUMCanrl37xNxHbRYM0xjEePIKqR9FwkwfMA
  • amazonses:D2u7PobrzkOIxT+VaeiZC0jJK9jhvijcvQcIhFIw3YM=
  • miro-verification=cbfdb5de5a414b0cb0371119900e27afa66e1f86
  • mongodb-site-verification=YGdHrKREExSbJzIhu7zmY8gQiqhdWl6f
  • flexera-domain-verification-clfqnvmktwmumgvq
  • atlassian-domain-verification=2R/ohK9m5Ozg50nBatKNYVcOCZsgHjRfsziJzutWmLDq32yASOMUrYlrszLxwqgn
  • MS=ms15611195
  • e2mbsfNKN7KKImPHd4wLJYDRp8Hu3EuBA4DtJuIMByNIIMKaw/vQ7+FQB1IZsAsbVZzr+GK79OgDjriuoqC01A==
Cloud / SaaS Services Detected
Amazon SES/WorkMail Anthropic Apple Atlassian Flexera Microsoft 365 Miro MondoDB Smartsheet

Leak Screenshot:

Leak Screenshot